GDB Helpsheet
Run the program:
gdb (output file name)
Debugging
Then we will enter gdb:
(gdb) break main # Add breakpoint at main
(gdb) run
(gdb) disas main # Disassemble code
(gdb) break *0x080483c1 # set breakpoint at specified address
(gdb) cont
(gdb) disas
(gdb) ni # execute the next instruction then gdb gets control again
Play with registers
(gdb) print $eax # print out the values of individual registers
(gdb) info registers # view all register values
(gdb) display $eax # use the display command to automatically display values each time a breakpoint is reached
(gdb) display $edx
Quick Summary
ddd a.out
(gdb) break main
(gdb) run 6 # run with the command line argument 6
(gdb) disass main # disassemble the main function
(gdb) break sum # set a break point at the beginning of a function
(gdb) cont # continue execution of the program
(gdb) break *0x0804851a # set a break point at memory address 0x0804851a
(gdb) ni # execute the next instruction
(gdb) si # step into a function call (step instruction)
(gdb) info registers # list the register contents
(gdb) p $eax # print the value stored in register %eax
(gdb) p *(int *)($ebp+8) # print out value of an int at addr (%ebp+8)
(gdb) x/wd $ebp+8 # examine the contents of memory at the given address
# as an int (w: word-size value d: in decimal)
# display type in x is sticky: subsequent x commands
# will display values in decimal until another type is
# specified (ex. x/a $lsebp+8 # as an address in hex)
(gdb) x/s 0x0800004 # examine contents of memory at address as a string
(gdb) x/wd 0xff5634 # after x/s, the unit size is 1 byte, so if want
# to examine as an int specify both the width w and d
Compile Program
$ gcc example.c -o example -fno-stack-protector -z execstack -no-pie
$ gdb ./example
(gdb) disas main
(gdb) b *main+65
(gdb) b *main+105
(gdb) r $(python -c 'print "A"*272')
(gdb) i r # info registers
Disable Protections
ASLR
To disable:
$ sudo echo 0 > /proc/sys/kernel/randomize_va_space
canaries
$ gcc overflow.c -o overflow -fno-stack-protector
DEP
$ gcc overflow.c -o overflow -z execstack
PIE
$ gcc overflow.c -o overflow -no-pie
GDB plugin
gdb-peda$ checksec
- gef
- pwndbg
Materials
- Assembly
- Heap and Stack Structure
- elf file structure, glibc
- memory protection technique
- python, shellcode
- dynamic debugging, linux kernel
Pwn tools
- GDB
- IDA Pro
- pwntools
- one_gadget
- libc search
- ROPgadget